# What is MEV?
**Part I.**

* Types of MEV
* Players of the game
* The block production supply chain
* The emergence of Flashbots

**Part II.**

* Long-term solutions (CL & EL)
* Endgame
* Conclusion

*Note, this paper was written pre-Merge in Q2 2022. As such, some sections may be dated.*

## Preface
MEV arises as a function of the overlapping preferences of market participants who transact on blockchains. MEV is a complex systemic problem for blockchains and solutions depending on implementation and have various externalities [38]. Ethereum, and more specifically the public mempool (the set of pending, unconfirmed transactions) has been described as the “dark forest,” a reference to the Cixin Liu science fiction, meaning “an environment in which detection means certain death at the hands of advanced predators. In this environment, publicly identifying someone else’s location is as good as directly destroying them.” In this paper, at a high level we attempt to illuminate the dark forest, by answering the question what is MEV? 

There is no way to eliminate MEV. Once a user sends their transaction to be included in a block there are economically incentivized, independent actors in the MEV supply chain who look for ways to extract value by re-ordering, inserting, censoring, or front-running any arbitrary transaction. According to Flashbots, the pre-eminent research and development organization working on mitigating the negative impacts of Ethereum MEV, 99% of MEV extraction today on Ethereum is arbitrage activities. Only the most sophisticated actors capture this value.

In the first half of the paper, we define who the MEV participants are, how they capture value, and the serendipitous emergence of Flashbots. Thereafter we transition explaining the MEV supply chain functioned in Proof of Work Ethereum, and how it functions post-Merge, in Proof of Stake Ethereum.

In the second half we examine what types of mitigation and redistribution strategies at the application and consensus layers are being developed by the top researchers in this domain. Finally, we address the existential threat of cross-domain MEV and postulate a conclusion about the MEV endgame, ultimately placing users in the privileged position that has been historically occupied by Miners. 

In summary, we believe awareness and understanding of this topic is critical for any market participant looking to build blockchain-based solutions or transact on public blockchains. Ultimately, composable blockchains that prioritize mitigating the negative externalities of MEV will reduce existential risk for their own chains, contribute to broader cross-domain MEV protection, and provide anti-fragile, censorship resistant public blockchains that mass adoption can more safely take place on.

# Part I - Introduction
What is MEV? MEV originally meant Miner Extractable Value. The term has since evolved to mean Maximal Extractable Value. MEV is the value that can be captured on chain in a game that is played between Miners, Searchers, Block Builders, Wallets and Users. The opportunity to extract value arises from ordering, censoring, and/or inserting transactions in front of or behind user transactions that can be seen in the public memory pool before being executed.[1] Historically, mining pools have sat in the privileged position of being able to select which transacts are or are not included in a block.

MEV provides an opportunity for any on-chain actors to extract value. Though the competition is fierce, access is permissionless. Flashbots estimates upwards of $720M of value was captured by MEV activities on Ethereum in 2021.[24] It is important to note that MEV opportunities are not distributed uniformly within blocks. They are unpredictable and can be highly lucrative as a result.

Understanding MEV is integral to understanding the block production process in both proof of work and proof of stake networks. The dynamics of the block space market directly impacts the transaction fees users pay and the order in which their transactions are processed.

MEV is a neutral force. However, MEV can be captured maliciously or in an inegalitarian manner. Thus, leaders in the space are thinking hard about how to mitigate malignant forms of MEV, but also how to democratize access for all users, while making block production as economically efficient and decentralized as possible.

The goal of this paper is to shed light on the game played inside Ethereum’s block production supply chain and what externalities have been realized as a result.

## (0.1) The Dark Forest

Welcome to the Dark Forest where any and all weaknesses will be exploited. In 2020 Dan Robinson from Paradigm wrote a post titled “The Dark Forest” where he outlined a collaborative rescue attempt of $12,000 user funds stuck in a Uniswap contract. The user mistakenly sent funds to a Uniswap LP token contract. At this point anyone could call the burn function on the Uniswap contract and capture the $12,000. Fearful of generalized front running bots The rescue team crafted an obfuscation strategy. 

Generalized front-runners, bots, would see transactions appear in the public mempool and replicate those transactions themselves and bid a higher gas price than a user in order to be included in a block first which would cause the users transaction to revert on chain; fail while paying the gas fee. 

The obfuscation strategy required the rescue transaction to be split in 2 parts so that a general front runner would not be able to decipher the intent of the first sent transaction.  The team’s local node had fallen out of sync, so they decided to use Infura. The first transaction failed, perhaps due to load balancing issues of Infura Nodes. As the clock was ticking to call the burn function and rescue user funds the team decided to ditch the obfuscation strategy. After a nerve wracking moment of waiting for confirmation, their transaction reverted. The team investigated the block and sure enough found a generalized front running bot had stolen their rescue transaction and claimed the user funds from the Uniswap contract [4].

There are always eyes on the Ethereum Mempool looking for opportunities to extract value. The mempool sets the stage for an adversarial game, MEV, played by rational economic actors. At first this game, identified by the Flashbots research collective, see section 4, was played only in the general mempool in the form of Priority Gas Auctions. PGAs are an all-pay auction where participants bid against each other to have competing transactions included in a block.

Later Flashbots moved the game out of the public mempool to an off-chain auction where searchers bid to have bundles included in block templates. After the merge, there will exist 2 layers of auctions. Builders will bid to have proposers choose their execution block while searchers will still compete to be included in builders blocks.

## (0.2) Lifecycle of an Ethereum Proof of Work Transaction

To help the reader gain an intuition we will briefly explain the lifecycle of an Ethereum transaction by reviewing how user transactions are submitted, propagated, ordered, & and ultimately mined, thereby included in a block. The concepts introduced here will help the reader build an intuition about the MEV supply chain that will be introduced in section 3. Later in section 5, we will examine Mev-boost, a middleware that plugs into Proof of Stake Ethereum’s architecture. The reader will gain a better sense for post merge block production there.


* User who has an intent to transact logs into their web3 mobile or browser wallet which is used to connect to decentralized application’s Front end 
* Wallet signs the user’s transaction, interacts with the Web3 API, then sends the user transaction to a local node. Some wallets rely on a Node service provider like Infura
* The Local Node receives the signed transaction and validates its correctness before propagating to Peer Nodes
* Full Nodes gossip the pending tx and store it in their general memory or “mempool”
* Mining Pools pick up transactions from the Memory Pool and order those by a greedy algorithm that sequences tx based on fees. The limit per block is 30M gas. Target block size is 15M
* The mining Pools create a block template and forward the headers to miners who compete to solve the difficulty puzzle, eventually giving the winning block weight in the fork choice rule
* Once a valid block  is mined the Miner will inform the network and the block will be broadcasted to and propagated by the full nodes who check that all of the block’s transactions are valid; full nodes can reject invalid blocks that do not follow consensus rules. 

There are four distinct economic actors in our example; the user, the wallet, the builder (mining pool) & the miners. Here, each party has their own incentives. Users who prefer to get their transactions included in a block will pay a gas fee. Wallets who wish to acquire more users provide the lowest latency. Mining pools are incentivized to include transactions paying the highest fees.  Miners are incentivized to compete for the Coinbase reward received for mining a valid block. 

Miners sit in a privileged position because they have the exclusive ability to order or censor user transactions while inserting their own transactions to capture extractable value. Take for example a user who has an intent to swap ETH for Token X on a decentralized exchange. This user’s transaction leaks value because they will accept a non-zero slippage on their trade. A miner could front run the user by placing an order to copy the users buy order which will give the miner a better fill. The miner could then place an order behind the user transaction to Sell Token X and capture the back run opportunity created.  This is known as a sandwich, which can be included in a block and executed atomically at the discretion of the Mining Pool. This is just one example of how a miner could extract value created by a user. We will review the general categories of MEV in section 1. 

# Types of MEV
There are four general types of MEV: Arbitrage, Liquidations, Sandwich (front/back run), & Long-tail.[2]


## (1.1) Arbitrage
Arbitrage opportunities account for 99% of all MEV captured.[0] Arbitrage plays an important role on-chain as Decentralized Exchanges (DEX) rely on arbitragers to keep prices of their Automated Market Makers (AMM) in line with competing AMMs and off-chain oracle prices.


A common arbitrage opportunity occurs when AMMs that contain the same token pairs, e.g., ETH-DAI, across different decentralized exchanges are imbalanced (divergent value), allowing for a buy or sell order that can bring prices of both AMMs back in line. Another example would be off-chain to on-chain arbitrage from a Centralized exchange to a DEX. This paper does not touch on or speculate on this type of arbitrage.

## (1.2) Liquidations

Liquidations occur when a debt position on-chain becomes undercollateralized. Users who seek liquidity for their on-chain assets can post them as collateral in order to take out a loan. When the loan falls below a specified Loan to Value ratio the debt position enters liquidation. Protocols like Maker Dao will auction off the collateral to be liquidated in order to repay the loan and remove the debt from the system.

*Source: Flashbots MEV Dashboard v0.1*

Liquidators (Keepers) receive a fee for their services in addition to the discount on the collateral they purchase for their services. Because liquidations can be quite profitable there is much competition amongst searchers to capture this form of MEV. As the charts above suggest, Liquidations can be extremely lucrative and represent some of the best MEV opportunities for Searchers able to capture it.

## (1.3) Sandwhiches

Sandwiches are probably the most well-known form of MEV as they are user facing. A sandwich occurs when a user sends a swap transaction to the general memory pool with a non 0 slippage.

An MEV bot, deployed by a Searcher, will front run the user by placing a transaction in front of the user’s transaction to get a better fill while then filling the user at their max slippage tolerance by moving the price before their trade is executed. The Bot will then place a transaction behind the user known as back running to capture the profit of the price being bid up. The user winds up paying a higher price for their swap via slippage and their assets are now worth less post sandwich than they would have been with no front-run/back-run.

Users can mitigate Sandwiches by using Flashbots protect, RFQ orders, Batch auctions, or other direct to miner relay services (Ethermine, Bloxroute).

There are other novel Sandwich type attacks like Just in Time Liquidity which benefits traders looking for deeper liquidity on Uniswap V3 but the MEV capture comes at the cost of the Liquidity Provider. The Bot will see an order in the Mempool, create a transaction to front run,add Liquidity ahead of the trade to capture the LP fee, and then remove the liquidity after the swap is complete. JIT Liquidity accounts for less than 0.1% of Uniswap V3 trades currently.[2,7]

It should be noted that Sandwhiches can help improve order flow routing improving social welfare for all users.[39]

## (1.4) Long-Tail MEV
LTMEV activities denote uncommon or infrequent types of MEV not mentioned above. Long-tail MEV can be the most profitable. It is captured by interacting with lesser-known protocols, employing event-based strategies or exploiting design mechanisms. For example, an MEV bot could front run a fraud prover by posting a fraud proof to the network and then claim the reward for successfully proving fraud. This was done during the attempted Rainbow Bridge exploit.[8]

## (1.5) Generalized Front-Running

Generalized Frontrunning is sometimes considered a “malicious” form of MEV. A generalized front-runner bot will search the Mempool for profitable transactions then copy the transaction and replace the sender address with their own, then increase their bid (gas price) to price + x to be included in a block first frontrunning the original Searcher. In a sense this could be considered MEV stealing. Searchers use private relays to lessen this impact. Though if a Searcher uses a particular strategy repeatedly even through a private relay the transaction will still land on chain and become known to observers who can write frontrunning algorithms for specific instances.

NFT front-running is an emergent form of front running that can exploit users attempting to mint an exclusive NFT. A searcher can exploit the rules of the mint by being first in line repeatedly by paying higher transaction fees and inserting their own mint transactions in a block before anyone else. Depending on the logic of the mint contract the Searcher can even mint out an entire collection with one transaction [34].

# Players in the Game
## (2.1) Users
Users are the individuals transacting on the network both at the institutional and retail levels. Sophisticated users can enjoy front-running (no one can place an order ahead of user transactions having seen it in advance) free execution by using services like Flashbots Protect for sending transactions. In addition, users can receive front running protection when trading by using services like COW swap or Archer Swap. It is the user’s order flow which creates MEV opportunities. By default, users often send their transactions to the public memory pool.

## (2.2) Wallets
Wallets are the medium with which users interact on chain. Wallets can give users the ability to send transactions over a private relay which will send their transactions to a private memory pool to be included in a block. In the future it is expected that wallets will receive payment for order flow from searchers and in turn provide better order execution and/or gas refunds to users.

## (2.3) Searchers
Searchers scour the public memory pool for arbitrage opportunities. A searcher will look for an opportunity to insert a transaction(s) of their own to capture value from changes in the global state. The searcher will then create a ‘bundle’ of transactions that they send using a private relay either via a service like Flashbots, Blockroute, Ethermine, et al. In some cases, searchers directly send transactions to miners. Searchers will be selective who they send transactions to in order to shield long-tail opportunities from attention or to customize their ordering preferences.[4]

Typically, Searchers specialize in one form of MEV over another. As arbitrage opportunities have become crowded, profitable searchers have shifted their focus to long-tail opportunities. Though many searchers operate independently, there are MEV collectives like Project Blanc where Searchers work together to capture MEV while taking a large slice of the opportunities.[31]

Searchers are experts at optimizing for gas savings, the game known as gas golfing. Some will shuffle through contract addresses to get one with as many leading 0s as possible.[32] The EVM gas fee schedule charges less for 0 bytes in a transaction’s input data. Skilled searches can optimize their contracts for more gas efficiencies by writing their contracts in the lower-level assembly language, Yul, which gets you closer to the Ethereum Virtual Machine (EVM) Byte Code (non-human readable opposite of source code).

In the past, Searchers were known to use self-destructs or gas tokens to pay for transactions.4 The tokens could have been purchased when gas prices were cheaper. Searchers leave no stones unturned in looking for ways to optimize for gas savings allowing them to bid more during auctions.

## (2.4) Builders
The role of the builder is played by the mining pool who selects the transactions that are put into the block. The builder then forwards the hash of the block header to the miners, who compete to mine the golden nonce [24]. When mining pools or builders receive bundles of transactions from searchers via a private relay like flashbots they participate in an auction by selecting the bundles with the highest profitability. Builders will simulate blocks in parallel that determine how profitable a block with n amount bundles will be.

The Builder is incentivized to include the searcher’s bundle at the top of the block based on a fee they receive from the searcher via gas paid for execution of the bundle or directly through the block’s coinbase transfer (reward for mining a block). A Miner using flashbots must also reserve space for transactions in the public Mempool.

## (2.5) Miners
Miners play the role of block proposer. Miners receive block template from builders (mining pools/MEV-Geth workers) and attest to it via a hashing algorithm, which gives the block economic weight allowing mining participants to come to consensus.26 Miners capture a priority fee paid by users as well as the coinbase reward for mining a block. Therefore, the higher a transaction fee is relative to other transactions in the Mempool, the more likely a transaction will be included in a block.

## MEV Supply Chain

For Mining Pools, block production is no longer trivial as described above. Priority Gas Auctions increased competition and demand for blockspace and transaction inclusion. Thus, private relationships between mining pools and searchers/trading firms began to emerge.30 This could have led to a highly centralized block production cartel.

Instead, Flashbots created MEV-Geth, a bespoke Ethereum client implementation, that provides a trusted MEV-relay for searchers to send transaction bundles to mining pools and provides mining pools software that simulates Searcher Bundles and Mega Bundles vs. Vanilla GETH blocks (using the greedy algorithm) to ensure profit is maximized [30].

There is a high trust agreement between Searchers and Miners with flashbots acting as an intermediary.4 The Searchers agree not to spam miners with unprofitable bundles while the miners agree not to unbundle searcher’s transactions. In a way this relationship secures the block production market by ensuring the most economic value is extracted. Hence, Flashbots has seen dominant adoption amongst miners with over 90% [24].

# Flashbots & MEV
Flashbots is a research and development organization working on mitigating the negative externalities of current MEV extraction techniques and avoiding the existential risks MEV could cause to state-rich blockchains like Ethereum. Their primary focus is to enable a permissionless, transparent, and fair ecosystem for MEV extraction. It falls under three goals:

* Democratize Access to MEV
* Bring Transparency & Awareness to MEV Activity
* Redistribute MEV Revenue

Flashbots built MEV-Geth, MEV-Inspect, MEV-dashboard v0.1, MEV-Boost & SUAVE (building).

## (3.1) Priority Gas Auctions (PGAs)

Priority Gas Auctions is a term, coined in the Flashboys 2.0 paper, that describes the hyper-competitive game that MEV Bots (front runners & arbitragers) played in order to get their transactions included in a block first. MEV bots would spam multiple orders (same account & nonce) with higher gas prices until their profit margins were eliminated. A bot could cancel their order by replacing their bid with a transaction paying 21,000 gas, the cheapest Ethereum transaction, costing them a small fee compared to their MEV opportunity. Effectively Arbitrage bots were bidding against each other in the form of a hybrid English/All-pay auction which the miner arbitrated. The miner was incentivized to order competing transactions based on the highest bids (fees).

*Source: Daian et al, Flashboys 2.0…*

PGAs had negative impacts such as33 :
* Unnecessary P2P Networking load
* Inefficient Miner and Searcher coordination
* Failed Bids reverted on chain -> Artificial Blockspace demand -> disequilibrium
* Searchers not able to express granular preferences

These Negative externalities were borne by average Ethereum users who now had less assurance on transaction inclusion guarantees and faced consistently volatile gas prices. Enter MEV-GETH.

## (3.2) MEV-Geth

Previosuly, Flashbots provided a pivotal service in the block production supply chain which moves the PGA game away from the public mempool and makes MEV capture more efficient. To achieve this, the Flashbots team built MEV-GETH (Maximal Extractable Value – Go Ethereum), which is Flashbots’ bespoke implementation of GETH, provides a way for mining pools to delegate the task of finding and ordering transactions to Searchers. GETH is overwhelming the most used execution client implantation of Ethereum. These searchers compete amongst each other to find the most profitable transaction ordering and bid for their inclusion in the next block using a standardized template called a transaction bundle.

These bundles are evaluated in a sealed-bid auction, Flashbots Auction,hosted by mining pools. The goal of these auctions is to produce a block template which holds the information about transaction order required to begin mining.transaction. The highest bundle bid will be included at the top of the block. Bundles cannot have ordinary transactions from the general mempool inserted between them. They must follow sequentially in a block.

The searcher bundles allow for granularity and expressivity. A searcher can specify parameters like a particular block height or transaction execution order which, if not met, will revert off-chain. This is a major improvement from PGAs where reverted transactions had Searchers pay unnecessary fees with questionable inclusion guarantees. A searcher bundle can consist of one or multiple transactions. There is no upward limit for how many transactions can be included in a bundle, but it is limited by Ethereum’s gas limit (30M).

A searcher may send their bundle to a relay who specializes in merging bundles or forming Mega Bundles. Miners specify a whitelist of relays they are willing to accept merged bundles from. Mega Bundles were implemented in Alpha v(0.4) release of MEV-Geth. Mega bundles must be executed at the top of a block with transactions executed in the provided bundle ordering. Miners pick up Mega Bundles if they are more profitable than the best-known block so far. This leads to significantly increased profitability, approiximately +50%.[34]

The Searcher bundles are simulated by workers in parallel who compare multiple block constructions to find the most profitable template. The Header of the Block template, once selected and packed with transactions, is forwarded to miners to mine for the golden nonce.[4,24]

MEV-GETH is more than software, however. By creating a trusted MEV-relay intermediatory, Flashbots gives a strong guarantee to searchers that their transaction bundles will not be unbundled down the supply chain which could allowifor MEV stealing. Flashbots also makes a guarantee to mining pools that the searcher’s bundles contain high value transactions. In the past it would have been possible for a Searcher to distributed denial-of-service (DDOS) attack a miner by sending bundles filled with low value transactions costing more to execute than the value extractable. Indeed, searchers had to build trust relationships with individual mining pools to ensure their MEV would not be stolen.

# MEV-Boost

MEV-Boost is an implementation of Proposer Builder Seperation (PBS) provided by Flashbots developed in collaboration with Ethereum developers and researchers. Validators running MEV-Boost maximize their staking reward by selling blockspace to an open market of builders.

MEV-Boost is sidecar (middleware) software that is client agnostic and sits between the execution and consensus clients, unlike MEV-GETH. The sidecar handles the relay, escrow, profit switching logic for selecting the most profitable payload, and provides a fallback mechanism to a local execution client like GETH if relays get disconnected.28 Multiple relay services will exist however, which builders would likely route through.

MEV-Boost aims to be a test for in-protocol “Proposer-Builder Separation,” where the roles of the block proposer and builder are specialized, which will become prominent after Ethereum has transitioned to proof of stake. Indeed, a significant benefit of division of labor is role specialization and optimization which increases the profitability and efficiency of the block production supply chain.

## (4.1) MEV-Boost Design [28]


* Validators can but are not expected to produce blocks. Instead, builders will sequence transactions in blocks, including bundles received from searchers, as well as transactions from the general memory pool.
* The Builder then forwards block header with a payment (bid) to the proposer, and a commitment to all the transactions to relays, who then communicate with the proposer of the current slot.
* The relay is specialized in denial-of-service protection and networking. The relay validates and routes execution payloads from builders to proposers.
* In between, the escrow, who is trusted by the relay for data availability and privacy, receives the full execution payload from relays.
* The proposer who is incentivized to choose the payload with the highest bid, then signs the execution payload (stripped of contents) with the highest fee.
* The proposer then returns the header to the relay and escrow to be propagated over the p2p network

In this way builders sit in the privileged position as they can sequence transactions, insert transactions, censor transactions and merge searcher bundles.

**Trade-offs with this design**:

* Information Leakage leading to centralization – large builders will likely also run relays and validators which could create a centralized block production design
* Relay proposes bad payload – inaccurate payload, inaccurate value, missing data
* Sealed bid vs open auctions – If open, missed slots as builders wait for lowest possible bid
* Out of protocol bribes – Builders could collude to make artificially low bids and share the MEV with Validators out of protocol
* Transaction Censorship – In protocol PBS will have Censorship resistance lists

# Part II Long-Term Solutions

## (5.1) Two Slot PBS

In theory, PBS has a near identical construction with MEV-Boost. A core difference however is the role of the relay and escrow are performed in-protocol. Therefore, the trust relationship between the builder and the block proposer is guaranteed by Ethereum. Currently, the Ethereum Foundation is researching two varieties of PBS: 2 Slot and 1 Slot. The above diagram showcases the flow of what a 2 slot PBS mechanism could look like.

* **Execution Header published**; contains execution block hash, bid, and signature from builder
* **Beacon block deadline**: beacon block must include the winning execution header
* **Beacon Block Attestations**: only one committee
* **Intermediate block deadline**: the winning builder publishes intermediate block, contains execution block body and visible Beacon Block attestations
* **Intermediate Block Attestations**: remaining N-1 committees attest to the intermediate block
* **Signature Aggregation of intermediate block attestations (BLS)**
* **Next Execution Header published**

In this 2 Slot PBS scenario, each slot would span about 8 seconds in time [29]. Effectively there would be two rounds of attestations for the same beacon chain block, one with only the header of the execution block and another round with the block’s full body. If the Beacon block is missing by the deadline, the next slot will switch from an intermediate block to a Beacon Block [17].

## (5.2) Single Secret Leader Election (SSLE)

In SSLE, in the context of the Beacon chain, a group of validators aim to randomly choose exactly one validator from the group, with the restriction that the identity of the proposer will be known exclusively by the chosen proposer. The specific implementation details are not locked in stone.

Vitalik Buterin recently proposed a shuffle protocol relying on a size-2-bind-and-swap primitive that proves 2 output commitment s are re-encryptions of 2 given inputs without revealing which is a re-encryption of which.11 The shuffle protocol would use a large amount of these bind-and-swaps to shuffle commitments. Eventually a commitment is picked to be a proposer. The proposer would need to reveal their identity to claim their proposal opportunity. However, the proposer remains unknown until the block is published. [12]

Currently block proposers are known in advance of their slot. This opens validators to DDOS attacks due to an exposed IP address, which could directly impact at home staker’s ability to capture MEV.[15]

An attacker may be incentivized to perform this attack if they propose a block in the next slot. By DDOSing attacking the proposer of the current slot s1, proposer for s1 would miss their slot. The attacker then would have 2 slots worth of MEV to extract.

## (5.3) Verifiable Delay Functions (VDFs)
A VDF is a commit reveal scheme for randomness, that introduces time delays. For example, the Beacon chain has 32 Slots per epoch. Randomness r is generated at the 32nd slot for future epochs. During the Epoch, the proposer is invited to reveal a secret they have committed to. Hashed secrets are what generates randomness r. With VDFs the value of r is only revealed well after the slot is finalized.[13]

Without VDFs, if a proposer of slot 32 decided not to reveal their secret to bias randomness they could in theory position themselves to propose blocks at specific heights to take advantage of a specific NFT mint or token launch.

## (5.4) Single Slot Finality
Ethereum is shifting from proof of work to proof of stake and hence its sybil resistance mechanism and block production consensus is changing. While Ghost LMD provides dynamic availability like the current GHOST Consensus (Nakamoto family) it also provides provable finality with Casper FFG. This means blocks can be finalized after 2 epochs, 64 slots. However, even with a heaviest chain fork choice rule there is still the possibility of multi-block re-orgs.15 As a result, Ethereum Researchers are investigating how to implement Single Slot Finality for the Beacon chain making Ethereum blocks final in each slot. This would eliminate multi-block MEV related re-orgs entirely.

The limiting factor is BLS signature aggregation. 100,000s of signatures will need to be aggregated for each slot. BLS signatures allow for signature aggregation. Today signature aggregation is done on peer 2 peer subnets. Each committee has signatures aggregated into its own subnet There are 16 randomly assigned privileged aggregators who make aggregates and commit them to the main subnet.14 The proposer then takes the aggregate from each committee, aggregates those together in order to make a single combined aggregate. This scheme imposes a high load on subcommittee validators. Current EF research is focused on this problem, with a time to market of 2 years or more.

## (5.5) MEV Smoothing

Smoothing MEV means reducing the variance in the MEV that is captured by each validator, with the goal of getting the distribution of rewards for each validator to be as close as possible to uniform: a staker would then get a share of rewards proportional to their stake, just like with issuance.[16]

A committee-based approach could be optimal on Ethereum as there is a reliance on 100,000s at home Validators participating in consensus. In this scenario the validators proposing a block would receive an equal distribution of MEV as any validator who is attesting to the validity of the block as well as the proposer. The block proposer in this scenario would not receive all the MEV from the block, but instead share with committee members who made attestations. This approach assumes an implementation of Proposer Builder separation.

As Ethereum scales to accommodate users, developers, and applications, MEV is shifting from Ethereum’s layer 1 enshrined execution environment to layer 2. Layer 2 is a broad term. In Ethereum, layer 2 generally refers to rollups, both optimistic and zero knowledge, as wells as Validiums, optimistic chains, and new hybrid constructions allowing the user to choose full on chain security or only settlement like Voltions or Celestiums.

# LT Solutions at The Exec Layer

All these Layer 2 constructions typically have a more centralized block production scheme than Ethereum’s, often using a single sequencer. The leader selection process of the rollup and defined protocol rules will dictate how MEV is extracted on rollups. Optimism is focused on MEV auctions while Arbitrum is focused on fair sequencing. In addition, services like Chainlink and Shutter plan to offer additional threshold encryption schemes which could combine with the above to help eliminate generalized front-running activity.

## (6.1) Fair Sequencing & Threshold Encryption
Fair sequencing refers to predetermined methods of sequencing transactions. The intuition here is that specifying protocol rules for ordering transactions is fair because it helps prevent information leakage which can be used to extract MEV.

Arbitrum an Ethereum Optimistic rollup currently processes transactions in this method. Recall on a rollup a user sends transactions to a sequencer who sequences the transactions, collects batches, and posts the rollup block data to Ethereum in the form of call data. If sequencer is honest then transactions are processed first come first serve. The sequencer’s output fully determines the state of the rollup [19].

The advantage to a first come first serve ordering for Arbitrum is that users receive fast transaction pre-confirmations and do not need to worry about being front run if they trust the sequencer. Once the sequencer sends batch of rollup data to the Layer 1 contract it is final unless fraud is proven through and interactive fraud proof game.

If Builders or in the case of rollups Sequencers cannot re-order or insert their own transactions, Searchers who optimize for speed become the privileged entities as they become incentivized to co-locate in data centers where the sequencer resides, like High Frequency Trading. In this way MEV can still be extracted by top of block arbitrage, back-running, optimistic sandwiches, and special arbitrage to identify a few examples.

Fair Sequencing can come in several flavors like First come first serve ordering which can be coupled with commit-reveal protocols, the same with delayed recovery, and threshold encryption [18]. The common feature of these cryptographic technique is to hide the transaction data itself, waiting until the order at the consensus layer has been established, and to reveal the transaction data later for processing. This preserves the causal order among the transactions that are executed by the blockchain.

A Threshold Scheme requires a Threshold committee to generate encryption and decryption keys. The following actions are taken by the committee:

* Commit - send commitment of private information
* Sequence - sequence orders
* Reveal - commit revealed once ordering is final

Committees could be specialized entities like keepers, rollup sequencers in a permissionless environment or a Distributed Oracle Network. For example, Chainlink is actively building out a Fair sequencing implementation, Fair Sequencing Services (FSS). In addition, Osmosis, an app-chain DEX in the Cosmos ecosystem, is also developing a Threshold encryption scheme [20].

One of the drawbacks of this approach is significant communication overhead is added to the network. MEV can also leak to the settlement layer with First Come First serve ordering as censorship is incentivized. Also, not all transaction metadata can be encrypted as some metadata information must remain transparent for transactions to be executed, including gas price, gas limit, and account signatures. This allows for the aforementioned information leakage which could be used for optimistic front running.

Even so, Fair Sequencing & Threshold Encryption is a powerful combination that if implemented appropriately could improve some of these trade-offs.

## (6.2) MEV Auctions

Today Optimism which is an Optimistic Roll-up that settles on Ethereum relies on a centralized sequencer controlled by the Optimism Foundation. In the future Optimism plans on selling the right to participate in their decentralized sequencer network. In effect potential Sequencers will be bidding to produce blocks. Optimism DAO will auction off the right to reorder transactions within an N-block window to the highest bidder. This MEV Auction (MEVA), grants the winner of the auction the rights to reorder submitted transactions and insert their own, if they do not delay any specific transaction by more than N blocks. This should help quantify the value of MEV of a given block, as a potential Sequencer would only bid up to a threshold of their total projected profit margin [21].

The MEVA Auction could be done well in advance of specific block slots to enable a time based MEV smoothing of sorts where the bidder of the auction would not be able to bid on a granular per block basis. Here the DAO would lock in Sequencer revenue. While they may miss out on fluctuations and long-tail opportunities which would prove more profitable for the sequencer in this scenario, The DAO could lock in revenue in doing so also mitigate collusion around slot-based bidding.

The Value captured by the OP DAO in the form of the fees collected will be used to retroactively fund Public Goods. The idea is to have MEV subsidize the growth of Optimism through retroactive public good funding. There are moral and ethical questions around this approach that governance will contend with. Also, it remains to be seen if this Robinhood type of strategy will motivate users to transact on Optimism over other roll-ups knowing that their MEV is funding public goods.

Conveniently MEVA auctions are composable with Fair Sequencing and threshold encryption schemes. The Sequencer in this case would bid up the right to back-run users and win arbitrage opportunities at the top of every block.

Trade-offs to this approach include significantly increasing latency for many transactions. A dishonest sequencer could censor transactions if protocol rules are not specified which could include requiring the sequencer to post a bond and face slashing conditions for censoring user transactions. A sequencer could re-sell their winning bid and order transactions based on an off-chain bribe.

## (6.3) Batch Auctions

Batch Auctions have been a popular research topic as a solution to mitigate pricing inconsistencies in High Frequency Trading. In a Batch auction orders are placed and collected off-chain, not executed immediately. The orders are then aggregated and settled into batches matching users by finding a coincidence of wants directly or through ring trades. Currently, on Ethereum, Cowswap has the most popular Batch Auction implementation [35].

Cowswap’s Batch Auctions work as follows. A user signs a transaction off-chain which routes their orders to a “solver.” A solver is anyone who submits a solution for a batch (order settlement). Solvers compete to find the best order execution by using the user’s liquidity to match orders directly by finding a coincidence of wants and/or by using multiple user orders to create rings which help facilitate the order matching. For example, when multiple traders hold an asset that the others want their orders are matched and settled directly between these users without the need for an external market maker or liquidity provider. After the COW/Ring process is complete there will be a remainder balance that needs to get posted on chain for execution. The remainder of unfilled orders are routed through a Dex aggregator to complete the transaction [35].

Hence, Batch Auctions combine off-chain interactions with on-chain interactions in the same transaction. This allows all traders in a “batch” to receive the same price on their orders while maintaining protection from generalized front-running and sandwich attacks.

# Endgame
## (7.1) Cross-Domain MEV
Cross domain-MEV is an existential risk to the decentralization of blockchains. Cross-domain MEV is the value captured from arbitrage transactions executed in a specified order across multiple domains (blockchains L1/L2) [22].

Sophisticated operators across multiple domains are positioned to take advantage of opportunities that are not available to all market participants. For instance, in the above example by Westerngate you can see the flow of transactions starting with 44961 Matic on Ethereum ending on Polygon with 46747 Matic [22]. Larger players can execute cross-chain arbitrage sequentially in this way, having an advantage with networking latency versus regular users. Though, execution is still a risk in this scenario as it relies on message passing and multiple contract interactions.

However, more importantly, a large operator could validate on multiple chains and be able to maintain a large inventory of tokens at any given time allowing for cross chain atomic arbitrage. This is especially troubling if these cross-chain operators are consensus validators who due to their sophistication will earn more rewards than their peers and eventually dominate the MEV market as their stake weight in proof of stake validation increases. It could be trivial for a large player to censor transactions and find new ways to extract rent from users. There would likely also be collusion or collaboration amongst the behemoth cross chain actors. This type of scenario would diminish blockchain decentralization and would enshrine a rent seeking oligopoly that can exploit users via sole domination of the block production supply chain.

As Vitalik noted in his ‘Endgame’ article, block producers are likely to succumb to the MEV forces and wind up centralized either as one rollup dominates, or multiple rollups dominate, but have the same set of block producers. In this case, the decentralization of the base layer Ethereum is what will ensure the integrity of the protocol. With Danksharding enabling Data Availability Sampling, Verkle Tries enabling statelessness, and distributed validator technology enabling smaller staking pools, the power to attest to valid blocks and reject invalidate blocks as a light validating node will ultimately keep the Network decentralized by increasing user participation in the consensus process.

## (7.2) Payment for Order Flow

In traditional financial markets payment for order flow is common. However, it is a new phenomenon in the space of blockchains.
In this scenario, Searchers/Builders would pay to receive order flow from Wallets or Applications. For example, a searcher/builder may specialize in arbitrage and as a result be able to guarantee specific profit margins on their operations. This would allow them to bid some portion of their profit margin for transaction order flow of wallets.26
* The Wallet benefits by securing users ‘gasless’ or minimal slippage swaps while the Searcher benefits from reliable order flow.
* As the Searcher receives order flow, they are incentivized to provide builders with the best bundles in order to maximize their profit (flashbots auctions).
* The builder may decide to merge with the Searcher or secure specific relationships securing specific wallet order flow directly.
* The Builder will bid up to their minimum profit margin to the Proposer for their block to be selected and signed by the proposer then released and appended to the canonical chain.

If Payment for order flow is implemented in an open and decentralized way everyone up and down the supply chain can benefit. The division of labor will help users negotiate the terms of the game, placing them in the privileged position to extract value. Users are in the ultimate position to choose were transaction order flow goes. Wallets and dapps will have an important role in building MEV aware systems. In this world, power is placed back in the user’s hands.

# Conclusion

Indeed, as cryptography progresses along with software development and reduction in resource requirements, MEV mitigation at the protocol level is likely. There will be a progression of implementing consensus changes like SSLE, VDFs, SSF, & zkEVM. Changes that require social consensus like PBS will need strong support.

The most promising solution at the consensus level is committee based MEV smoothing. In this scheme committee members would receive MEV distributions equally based on per epoch attestations. Currently each validator attests at least once per epoch. Their MEV reward would be tied to this attestation, perhaps releasing MEV rewards linearly after each finalized checkpoint (2 epochs of 2/3 majority consensus). This would incentivize more stakers to run validators or participate in smaller staking pools because committee attestations, the work every validator contributes to consensus, are equal. No longer would a solo staker proposing a handful of blocks per year be at a disadvantage to large staking pools who smooth their rewards internally. As a positive externality this could reinforce a better staking distribution in the long-term setting Ethereum up to take advantage of Stateless clients, post Verkle Tries.

MEV Smoothing could also force the community to have more conversations around what types of MEV are acceptable. In a PBS world, the proposer will be incentivized to accept the maximum bid from a builder. In an MEV smoothing world, the proposer does not have that incentive as they are accepting the bid for all participating validators. This could lead to discussion around whether blocks should contain sandwich attacks or other types of user-extracting MEV. Should builder bids, representing the MEV extracted, be burned? A clear benefit is the formation of social consensus around MEV.

MEV will exist in some form. Acknowledging MEV now while the market is still evolving at the infrastructure and application layers is critical. Existential risks like a centralized block production supply chain lurk but can be avoided by raising awareness of cross-domain MEV and testing mitigation strategies in production. Ethereum Rollups will provide a robust testing ground. The question becomes what tradeoffs are you willing to make and how fast can you execute?

# Acknowledgements

Thank you to the Flashbots organization, Ethereum Research Forum, Uncommon Core Podcast, Hasu, Vitalik Buterin, TheGoStep, Phil Daian, Alex Obadia, Georgios Kostantonopoulos and others for continuing to advocate for transparency around MEV and producing high quality research which laid the foundations for this paper.

Thank you to those who reviewed the draft and provided feedback.

# References
0. MEV Explore (flashbots.net)
1. Daian, MEV…..wat do next? MEV..wat do next? - Phil Daian (Flashbots) - YouTube , mev wat do next - Google Slides
2. Daian et al 2019, FlashBoys 2.0 Frontrunning, Transaction Reordering, and Consensus instability in Decentralized Exchanges [1904.05234] Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges (arxiv.org)
3. Ethereum.org, Maximal Extractable Value (MEV) Maximal extractable value (MEV) | ethereum.org
4. Hasu & MEV Intern 2021, Interview with a Searcher -with MEV Senpai and Hasu #29: Interview with a Searcher – with MEV Senpai and Hasu + transcript – Uncommon Core by Su Zhu and Hasu
5. Hasu, Konstantonopoulos, Robinson 2020, Understanding MEV Uncommon Core: Understanding MEV - with Georgios Konstantopoulos, Dan Robinson, and Hasu on Apple Podcasts
6. Thegostep 2020, Flashbots: . Frontrunning the MEV crisis Flashbots: Frontrunning the MEV crisis - Economics - Ethereum Research (ethresear.ch)
7. Flashbots 2022, Flashbots Docs welcome to flashbots | Flashbots Docs
8. Shevchenko 2022, On The Rainbow Bridge Attack Today Alex Shevchenko 🇺🇦 on Twitter: "🧵 on the Rainbow Bridge attack today. TL;DR: attack was stopped automatically, no bridged funds lost, attacker lost some money, bridge architecture was designed to resist such attacks, additional measures to be taken to ensure the cost of an attack attempt is increased" / Twitter
9. (2.4) @CHaininsightLabs 2021, Long-Tail Miner Extractable Value (LTMEV) is one of the most secrety forms of MEV, Chainsight 🔺 on Twitter: "1/ Long-Tail Miner Extractable Value (LTMEV) is one of the most secretive forms of MEV. Not only is it highly competitive, cartels of super shadowy coders lurk in the shadows to maximize profit. Below is #LTMEV from @ConvexFinance that earned us $23,200 profit in only 25 days🧵👇 https://t.co/lcF0j9ToAs" / Twitter
10. Feist 2021, New Sharding Design with tight beacon and shard block integration, New sharding design with tight beacon and shard block integration - HackMD (ethereum.org)
11. Simplified SSLE - Consensus - Ethereum Research (ethresear.ch)
12. Boneh, Eskandarian, Hanzlik, Grekco, Single Secret Leader Election 025.pdf (iacr.org)
13. Drake 2022, MEV & Cryptograhy (Flashbots Research Talks Justin Drake - MEV & Cryptography (Flashbots Research Talks) - YouTube
14. Buterin 2022, Path Towards Single Slot Finality Paths toward single-slot finality - HackMD (ethereum.org)
15. Buterin & Konstantonopoulos 2021, Ethereum Reorgs After The Merge Ethereum Reorgs After The Merge - Paradigm
16. Fradamt, Committee Driven MEV Smoothing, Committee-driven MEV smoothing - Economics - Ethereum Research (ethresear.ch)
17. Buterin, Proposer Builder Separation Friendly fee market designs, Proposer/block builder separation-friendly fee market designs - Economics - Ethereum Research (ethresear.ch)
18. Chainlink 2.0 Breidenbach, et al. 2021, Next Step in the Evolution of Decentralized Oracle Networks whitepaper-v2.pdf (chain.link)
19. Felton 2022, L2 Sequencing & MEV , L2 sequencing and MEV - Ed Felten (Arbitrum) - YouTube , Felten MEV Day talk - Google Slides
20. Luhn 2022, Protection Built into L2 using Threshold Encryption Protection built into L2 using threshold encryption by Jannik Luhn at MEV-Day - YouTube, Shutter MEV Day 2022 - Google Slides
21. Flouresh 2020, MEV Auction; Auctioning Transaction ordering rights as a solution to Miner Extractable Value MEV Auction: Auctioning transaction ordering rights as a solution to Miner Extractable Value - Economics - Ethereum Research (ethresear.ch)

22. Obadia et al. 2021, Unity in Strength: A Formalization of Cross-Domain Maximal Extractable Value [2112.01472] Unity is Strength: A Formalization of Cross-Domain Maximal Extractable Value (arxiv.org)
23. Buterin 2021, Endgame (vitalik.ca)
24. Miller, et al. 2022, MEV in 2021: A Year In Review
25. FpgaMiner 2012, sha256_top stop condition (bitcointalk.org)
26. Hasu 2022, The threat of MEV centralization: an anatomy of the transaction supply chain https://www.youtube.com/watch?v=GmBqoBr6yl4
27. Robinson 2022, Uni V3, How I learned to stop worrying and love concentrated Liquidity Daniel Robinson - Uniswap v3, or How I Learned To Stop Worrying And Love Concentrated Liquidity - YouTube
28. Thegostep, 2021, MEV-Boost: Merge Ready Flashbots Architecture MEV-Boost: Merge ready Flashbots Architecture - The Merge - Ethereum Research (ethresear.ch)
29. Buterin 2021, Two Slot proposer/builder Separation Two-slot proposer/builder separation - Proof-of-Stake - Ethereum Research (ethresear.ch)
30. Flashbots, MEV-geth spec v(0.6) current, v0.6 (current) | Flashbots Docs
31. Rose, Eigenmann, Aroutiounian, Zero Knowledge Podcast Episode 216: A Dip into the Mempool & MEV with Project Blanc
32. Roan 2021, Hitchhiker’s guide to the EVM Hitchhikers Guide to the EVM. Gas Golfing by Optimizing Storage | by Alex Roan | Geek Culture | Medium
33. Flashbots 2022, FAQ docs.flashbots.net/flashbots-auction/searchers/faq
34. Flashbots 2022, alpha-v0.5 | Flashbots Docs
35. Cowswap Docs, CowSwap - CoW Protocol
36. gastoken.io , How? GasToken.io - Cheaper Ethereum Transactions, Today
37. Current CrList Proposal Current crList proposal - HackMD (ethereum.org)
38. Gosselin, Unchained Podcast 388: Why is Ethereum trying to Maximize Value from users: A debate
39. [Kulkarni et al.,](https://people.eecs.berkeley.edu/~ksk/files/MEV_CFMM.pdf), Towards a Theory of Maximal Extractable Value I: Constant Function Market Makers